GiftPage Privacy Policy
Last updated: October 26, 2026
1. Introduction
ClearStack Apps ("we", "us", "our") operates the GiftPage mobile application and the pages it serves at giftpage-pages.web.app. GiftPage is a record kept by a salon, spa or other small business of the gift certificates it sells: who bought them, who they are for, what each is worth and what is left on it. This policy explains what is stored, where, who can see it, how long it is kept and how to delete it. It covers GiftPage only; the rest of ClearStack Apps is covered by our main privacy policy.
2. What GiftPage Stores
- The shop's account: an anonymous account is created when the app first opens. If the shop adds an email address and password, they are held by Google Firebase Authentication and never seen by us. The name a seat gives is stored with the shop.
- The shop's settings: the shop's name, page address, intro, phone, email, address and terms; the amounts and treatments it sells; its chosen design and, on the paid tiers, the photo it uploads as a certificate background.
- Certificates: for each certificate, its code, value, remaining balance, currency, the treatment if any, the buyer's name and email, the recipient's name and email, the buyer's message, the design, how it was paid, the date it was sold and any expiry date; and for each use at the counter, the amount, the time and the seat that took it.
- Card payments on the buy page: buyers pay through Stripe Checkout on the shop's own Stripe account. Stripe holds the card details; we store only what the order needs (the amount, the buyer's and recipient's names and emails, the message) and the Stripe payment id. We never see or store card numbers.
- Purchase check: if the shop buys a plan from Google Play, the purchase token, used only to confirm the purchase with Google and to renew or end the plan.
3. Crash Reports and Analytics
- Firebase Crashlytics (Google LLC): crash reports, device model, operating system and app version, so we can find and fix bugs.
- Firebase Analytics (Google LLC): basic usage events such as app opens and screen views, tied to a random ID for the app on your phone. The advertising ID is not collected.
These never include certificates, names or emails. GiftPage shows no third-party ads. The free tier shows a banner for ClearStack's own website service; nothing from the shop's records is used to choose it. Nothing in a shop's records is sold or shared with advertisers.
4. Where It Is Stored
On Google Cloud (Firebase) in the United States, encrypted in transit and at rest. The app keeps a local copy on the phone so certificates can be looked up and redeemed when the connection drops; a redemption or counter sale made offline is kept on the phone until it is sent.
5. Who Can See It
- Every seat of the shop (the owner and, on Pro, one member of staff) sees the shop's certificates.
- Anyone with the buy page address sees what the shop chose to publish there: its name, contact details, intro, amounts, treatments, designs and terms.
- A certificate's own page shows that certificate (its value, balance, message, code and QR) to anyone holding its link. The link carries a random token and nothing personal; it goes to the buyer and the recipient by email.
- Stripe sees the payment details of a buyer under Stripe's privacy policy.
- We do not read shops' records. Google acts as our processor to store them.
6. Emails
When a certificate is bought on the buy page, the buyer receives a receipt and the recipient (if the buyer gave an email) receives the certificate. The shop can also email a certificate from the app. The emails are sent through Resend, Inc. with the shop's email address as the reply-to. Nobody is added to a mailing list.
7. Deleting the Shop
In the app: Settings, then Delete account, and confirm. Or email support@clearstackapps.com from the address on the account. When the owner deletes the account, the whole shop goes with it: every certificate and redemption, the orders, the photo design, the published page and its address, and every certificate link. A member of staff who deletes their account leaves the shop; the sales and redemptions they recorded stay in the shop's records.
A buyer or recipient who wants their details removed from a shop's records asks the shop. Crash reports are kept by Firebase for 90 days and then deleted.
8. Your Copy of the Data
On the Certificates tab, Export CSV gives every certificate with its balance. Each certificate can be shared as a link or a PDF. Email us for anything else.